26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_DRIDEX.JE Sample 419af0d5a413… — Score 68/100 — Hybrid Analysis","description":"Malicious verdict for sample 419af0d5a413…. Malware family: TSPY_DRIDEX.JE. Threat score 68/100. 22/28 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","keywords":["Malicious","TSPY_DRIDEX.JE","malware analysis","sandbox report","threat intelligence","419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea"],"about":{"@type":"SoftwareApplication","name":"word.exe","applicationCategory":["peexe","executable"],"identifier":"419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","additionalType":"Malicious sample"},"threatScore":68,"malwareFamily":"TSPY_DRIDEX.JE","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d5,Found malicious artifacts related to "205.185.206.139" (ASN: 12989, Owner: Eweka Internet Services B.V.): ... URL: http://image.e.bowlmor.com/ (AV positives: 1/62 scanned on 03/18/2015 12:21:37) URL: http://files.webinstall.com/ (AV positives: 1/62 scanned on 03/18/2015 12:20:37) URL: http://download.cnet.com/Lazesoft-Recovery-Suite-Home/3000-2094_4-75749925.html?part=dl-10055229&subj=dl&tag=button (AV positives: 1/62 scanned on 03/14/2015 05:20:56) URL: http://lp.empire.goodgamestudios.com/?country=us&pid=1004&camp=1&gid=12&lp=emstratmap&SourceId=689&FB1=c2jl00000ay5rw&FB2=6025845680231&FB3=30&FB4=65&FB5={ts}&cid=6025845680231&tid{interests} (AV positives: 1/62 scanned on 03/14/2015 05:11:48) URL: http://download.cnet.com/DAZ-Studio/3000-6677_4-10717523.html (AV positives: 1/62 scanned on 03/14/2015 05:14:14) File SHA256: 589f5ef35840fc84b762aa9f29edb1be6dbb4e231733c93fac669ce55e3dedcb (AV positives: 11/57 scanned on 03/10/2015 11:46:34) File SHA256: bfe2b4725815a20a9a044e20ac2a75a4f213ac689a09b5e1b917c650aad50335 (AV positives: 10/57 scanned on 03/10/2015 11:33:52) File SHA256: 98e7a07999e1d9948aa9fd417877376e50f46b33c28c9a56d55d5489ae0ec3f6 (AV positives: 11/57 scanned on 03/10/2015 11:12:04) File SHA256: f1e7f7f66df64518f66235e7a9768ba01cfe780bf0588408557acb83cdf71017 (AV positives: 11/57 scanned on 03/10/2015 11:10:42) File SHA256: 0d57fdce36111346ad5ab48749bbb7172580663b9ae12612b91a1c3c91c2c2fc (AV positives: 11/57 scanned on 03/10/2015 11:08:43)28:Tb40,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAgESURBVFhHlVd7UFT3FaY6OtP4R8e000zTdpJxTHVqSqy2aUytdrRpxhpDjMQgaINC1KBRKxqCRoLVqEgFJCIQFggLCfIQeRNeu7yXffGG5bW8lscusAsssIs89uvv98O7sKxA3Jlv7r27d+/5zjnfeVwbm2f45OcXgEN2tgCPktOQTLBhw0Y8w2Osb7W1fQ2OjocZnJ2PIjExFXFxImQWFCG5pAmJpUrkC5oskFfYgSypEWUiLS5evMQIFBUVo66ugYHPj8HOnbvp90uTS0lJZ14crwS85SaEVuCpiCS/SWQmyOSwwsWL11FSUoaBAS3Gxw0wGicY6LmPjy9WrVq1OAk7u/2QSORIU03iTr0JV5YgEbsIgZDQeJRJVVAP6KDX680ElMoOuLqewpo1a5aOgkLRiKGhYYYg2cySkYh6Eoly6QxmMY1E8TCksilIe2cwoNVhZESPsTED/PyCsG7d+uX1ERAQiP7+AYZCxQBLx/xI8GSPcf9hpxnfkfOwxFaG0NhGCIVyKBTNUOnGoB6ZIFEYRVtbBz74wBHPP/+L5Qk4ODiivb0TnZ0qKDu64RXfCNfAIly+fBOenl/hypXr+OKLa7h69RauXbsNf/8MBIdUMISESiAWN5D8D0KnGyLej0Kt7odIJMG+ffuXN87VBNVBR4cKDQ1N8PNPgYsr7wlC8dlnt+DldRt3/FJIdTxEeno2SktbUS5uQ2NjMzPe29uH1tZ2BhoN+pzycinOnHHH6tWrlydCCVDlqtUaZGQr4HkpHvzoGuKJmBhpYXmlGuFSRe8bHNSS60EWOc44vVde24Dy6kYi7gqkpWXC3d3zxxHo61PDYDCiRTeJqLZJRojmc9b4EDSaWZ1QdHf3QKXqgaKtB1nV/fAr1+NCqh72SUNweDiIQxF1+PDDw/jI+WO8/PK65fuBWCxDbm4RMjOzUdurx9++NSGp1Qitbhhd/XrUqLSQtmqRrdAhoHgUh3NN2B1mwq8JtoVNYFugDs7BtTj7nwKcd4/HOQK309HLe85poLCwBIWFIuTk5KO6exgu+SbsSDPBLc0I+4RpvPXABHty/Tb53v4JnMnRNX4cxy5kIibmB9TW9RIxUwyjrGkaOflDSEtX425gLuzeO7m0FvIFxchSaFEgkaFKNcxKcSl8LCXGeUPw+JwPpbKdpWt0dBx9JE2VPZNW3TIgugHHXHiLRySXELAN7sKffOUo6pxYlsCNrD5c+W8eEaDW3PloK67qnoSUNKuFLftbvgk+virSG25gxYqV1kSSUjJhG67Gc+fkEDVqFp0JdFYElxhInmPRpdKZjdMINGofWxkuE5kQFk5mTBiZMQTXbzaQsv5yEQIkx88FDi9JIKTUhMvehRAIJBaDZzYFY9aeR80ZpwSCQydIZfwPr7yyYIQ/SsmAW+EUfhk5Y0EgVtCBVIEY9Tl81EfeQO3pLfC9cNPCc2760aOCaINDQoKlcUogM4ukwicC27e/bRmF1NQM9GgGkVujQUt7jzkFY0FvAfe3mlF0ahcSEuvR3DJJIjBuRcQkAzjo1BNITpkjkSeY1UaUsJ/sHSwNcyQoge7uXtZcKL4nozemUo+u1H/AyPu7mYDw5C7iRYc51DWqKag1RjL9xvFYOYX6hj4E3hPgGx55VreRtOVJknsTMojn84V55Ig71q//nSUBzjg90pvFFQZ8M3MCD3Su5Po+RqJ34JaHF3JJfS9UOd0DmpqncO9OAoR5bbjJk0IgHEVP7ySKiq2r4vjxU2zAmfczGgGOAB1K0gYTg4/uAIO3Zh+Oxa2Hm7cvhDLrOqcRSC4zICIoEtX1YwjjVUEuV7DI0ElLewUHobCITMr3LQlE8eMYga6ubrS0tEGmJasXwYnK1xiOVNhibdzP8M9LV59KQKvVkqjMwMPDHz5+PHx1Iwla7RAjQMe0liwqHOgg279/QQQiImPJOO4yTzUrApJNWMv/KXZ7eVqkgNZ5JCm1UtE0JqpmUB0/ipy4NtTXGWAYM5pFSonQwUZRUFCHd991sRQhJUA958YqR+B14jlD6Qb8PMQG2+/+Cw8fdZk1wIvgVG6CqMRkrgBDnRHjxOj8EuXOT38aAycnZ0sC4RHfo6KiBs3NSjQ1Kc0p+GP2b0Dx+7QXsDLUBmv9foWroRlkHZ/1nOtw3HG+2nW6OQI0AgaDAZVVLXB0+hIvvcRG9NyHF/4deR9IQUbGDxYaWE285kAJrAj+CfacP2vRXjnj+UJLtVeop60iEHA3AW++uRMrVy6YB5RAVlYu2QkEbJ1qHDBAOTyFF8JexfvZDjhZcALni4Pw+SMJQRfOnE1kbZUzTjvc/NKUVpMq0piYCGcXmzHiYAn27v0ImzdvsZ4FlEBpqRhR/HjSPJrMfV4zrIV+fIxdj5JVm3txuZvUDJ/bxYwA1+EsCPSboNKQ/xLRUQLJySJSeg6Lb0d79uxDSmo6qd0q1JKd7mnioRtvXnUH/BMl8LiXCgdnb7J03kLsgzlRSqtmPW8f0LPVTSKpR0BAAvP8yWq2+GvkG2/8FSEhEWzT5QhQD0QiKQIDQ+Hmdg4HDjhgx45doPe6uHyCF1/8LdmeA8gKHwNeuBgx0hGUyqbJui7H6U+j4XTYi+V88+aty++FlNrrf9lGppU/vv46mBg8g3feeQ92dvbYS46bNv2BwBZbtv7ZKocbN27CwYNOOHr0BGkyBxnRQ4f+zby2EtyPeJWGvf0h4tknHOv5x6X+/qz32/wfdW0EZQsLoeAAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":68,"unified_at_epoch_ms":1790337258392,"unified_at":"2026-09-25T11:54:18.392Z","metadata":{"hashes":{"sha256":"419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","sha1":"222bd69c97fb0465d9f273ca59fb6135a44aa459","md5":"51f0905f6106da318ff1c9eb5acb8313","sha512":"43c5af4b82f457680c60f321eea2803aea2bb805090198cc6b2a2a3b64ddfbd71da9474a63f93be15d8e594ac5f2c07e9a28e20bfb93e6a9877fc2a364a1565e","ssdeep":"12288:ibNgAZWBU6to6E+Sv+AfeineXe00TQ/uudaUzPFiM:iBrWd1A2ineO00TczP","ssdeep_chunks":["12288:ibNgAZW","12288:bNgAZWB","12288:NgAZWBU","12288:gAZWBU6","12288:AZWBU6t","12288:ZWBU6to","12288:WBU6to6","12288:BU6to6E","12288:U6to6E+","12288:6to6E+S","12288:to6E+Sv","12288:o6E+Sv+","12288:6E+Sv+A","12288:E+Sv+Af","12288:+Sv+Afe","12288:Sv+Afei","12288:v+Afein","12288:+Afeine","12288:AfeineX","12288:feineXe","12288:eineXe0","12288:ineXe00","12288:neXe00T","12288:eXe00TQ","12288:Xe00TQ/","12288:e00TQ/u","12288:00TQ/uu","12288:0TQ/uud","12288:TQ/uuda","12288:Q/uudaU","12288:/uudaUz","12288:uudaUzP","12288:udaUzPF","12288:daUzPFi","12288:aUzPFiM","24576:ibNgAZW","24576:bNgAZWB","24576:NgAZWBU","24576:gAZWBU6","24576:AZWBU6t","24576:ZWBU6to","24576:WBU6to6","24576:BU6to6E","24576:U6to6E+","24576:6to6E+S","24576:to6E+Sv","24576:o6E+Sv+","24576:6E+Sv+A","24576:E+Sv+Af","24576:+Sv+Afe","24576:Sv+Afei","24576:v+Afein","24576:+Afeine","24576:AfeineX","24576:feineXe","24576:eineXe0","24576:ineXe00","24576:neXe00T","24576:eXe00TQ","24576:Xe00TQ/","24576:e00TQ/u","24576:00TQ/uu","24576:0TQ/uud","24576:TQ/uuda","24576:Q/uudaU","24576:/uudaUz","24576:uudaUzP","24576:udaUzPF","24576:daUzPFi","24576:aUzPFiM","12288:iBrWd1A","12288:BrWd1A2","12288:rWd1A2i","12288:Wd1A2in","12288:d1A2ine","12288:1A2ineO","12288:A2ineO0","12288:2ineO00","12288:ineO00T","12288:neO00Tc","12288:eO00Tcz","12288:O00TczP"],"imphash":"ce04af43434b882e6263e2b4fd672257"},"file_info":{"file_name":"word.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":558080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297760000,"last_seen":1677364681000,"last_multi_scan":1677364681000}},"detections":{"summary":{"verdict":"malicious","score":68,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":9,"malicious_count":6,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Buzus.lyru","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.zued.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BLLL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Backdoor.JMZA-0644","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BLLL (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Battdil.J trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004b8a781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Win32.Dyre.tl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dyre.efhafd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AOGB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.558080.CI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.JE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.JE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransomer.JJJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanBanker.Dyre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dyre.Win32.271","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_DRIDEX.JE","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SHGetFolderPathW@SHELL32.DLL at 01965453-00002484-62806-15-004028B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"docs233.com\"\n \"stun.noc.ams-ix.net\"\n \"mx.docs233.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.60.139.27:80\"\n \"23.61.69.163:80\"\n \"205.185.206.139:80\"\n \"173.194.46.66:80\"\n \"91.200.16.56:3478\"\n \"91.200.16.37:3479\"\n \"67.222.202.183:443\"\n \"23.61.75.27:80\"\n \"195.154.163.4:80\"\n \"192.99.35.126:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /ml1from1.tar HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\nHost: 195.154.163.4\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\APPHELP.DLL\" at base 746F0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dVUtkBSmUlsiHjQ.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 01965453-00002484-62806-12-00402AA0\n FindResourceW@KERNEL32.DLL at 01965453-00002484-62806-11-00401490\n FindResourceW@KERNEL32.DLL at 01965453-00002484-62806-13-00402A30\n FindResourceW@KERNEL32.DLL at 01965453-00002484-62806-10-00402B10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 91.200.16.56\" with description \"Payload with 20 bytes: 0001000091401E00B7DFF0FFB74EB0E1260EAEE1\"\n \"UDP connection to 91.200.16.37\" with description \"Payload with 20 bytes: 00010000A8851E002BBDF0FF2B1575E183906BE1\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 01965453-00002484-62806-8-00402B50","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetStartupInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"dVUtkBSmUlsiHjQ.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")\n \"dVUtkBSmUlsiHjQ.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"dVUtkBSmUlsiHjQ.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Sat Sep 27 00:43:39 2092","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/55 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"dVUtkBSmUlsiHjQ.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 512 bytes starting with PE header signature to file \"C:\\Windows\\dVUtkBSmUlsiHjQ.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"dVUtkBSmUlsiHjQ.exe\" (PID: 00002896)\n \"\" wrote 52 bytes to a foreign process \"dVUtkBSmUlsiHjQ.exe\" (PID: 00002896)\n \"\" wrote 4 bytes to a foreign process \"dVUtkBSmUlsiHjQ.exe\" (PID: 00002896)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"level":"malicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 23.60.139.27 on port 80 is sent without HTTP header\n TCP traffic to 23.61.69.163 on port 80 is sent without HTTP header\n TCP traffic to 205.185.206.139 on port 80 is sent without HTTP header\n TCP traffic to 173.194.46.66 on port 80 is sent without HTTP header\n TCP traffic to 67.222.202.183 on port 443 is sent without HTTP header\n TCP traffic to 23.61.75.27 on port 80 is sent without HTTP header\n TCP traffic to 195.154.163.4 on port 80 is sent without HTTP header\n TCP traffic to 192.99.35.126 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":7,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"55b77b330e316dd412f1ee04","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":68,"malware_family":"Crypt.XPACK","contacted_countries":["CAN","FRA","NLD","USA"],"submit_name":"word.exe","analysis_start_time":"2015-07-28T08:00:06+00:00","indicators_count":{"informative":6,"suspicious":11,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.60.139.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"23.61.69.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"205.185.206.139","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"173.194.46.66","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"91.200.16.56","port":3478,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"91.200.16.37","port":3479,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"67.222.202.183","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"23.61.75.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"195.154.163.4","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"192.99.35.126","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"address":"95.211.189.208","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}],"dns_resolutions":[{"domain":"docs233.com","address":"95.211.189.208","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"domain":"stun.noc.ams-ix.net","address":"91.200.16.56","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"domain":"195.154.163.4","address":"195.154.163.4","country":"France","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"domain":"mx.docs233.com","address":"95.211.189.208","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}],"http_requests":[{"host":"195.154.163.4","host_ip":"195.154.163.4:80","url":"/ml1from1.tar","method":"GET","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}],"processes":[{"pid":2484,"ppid":0,"name":"419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","command_line":"","normalized_path":"","uid":"01965453-00002484","icon":"$28"},{"pid":2896,"ppid":0,"name":"dVUtkBSmUlsiHjQ.exe","command_line":"Z:\\419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea","normalized_path":"","uid":"01973375-00002896"}],"all_imported_dlls":["KERNELBASE.dll","DEVOBJ.dll","SspiCli.dll","IMM32.DLL","SETUPAPI.dll","PSAPI.DLL","sechost.dll","uxtheme.dll","ADVAPI32.dll","ole32.dll","CRYPTBASE.dll","GDI32.dll","SHFOLDER.dll","SHELL32.dll","msvcrt.dll","comctl32.dll","SHLWAPI.dll","RPCRT4.dll","LPK.dll","ntdll.dll","kernel32.dll","apphelp.dll","USP10.dll","USER32.dll","OLEAUT32.dll","CFGMGR32.dll","MSCTF.dll","VERSION.dll","dwmapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dVUtkBSmUlsiHjQ.exe","sha256":"c384edc5d612a82622608b8c5dd5ae1dc2872bcf8e9ef11f60ec3b027660aa67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]},{"path":"%WINDIR%\\dVUtkBSmUlsiHjQ.exe","sources":[{"report_type":"sandbox","report_id":"55b77b330e316dd412f1ee04"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["55b77b330e316dd412f1ee04"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TSPY_DRIDEX.JE Sample 419af0d5a413… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 419af0d5a413…. Malware family: TSPY_DRIDEX.JE. Threat score 68/100. 22/28 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_DRIDEX.JE Sample 419af0d5a413… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 419af0d5a413…. Malware family: TSPY_DRIDEX.JE. Threat score 68/100. 22/28 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_DRIDEX.JE Sample 419af0d5a413… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 419af0d5a413…. Malware family: TSPY_DRIDEX.JE. Threat score 68/100. 22/28 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]